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Dear Sir: 



PRE-APPEAL BRIEF REQUEST FOR REVIEW 

The following Pre- Appeal Brief Request for Review ("Request") is being filed in 
accordance with the provisions set forth in the Official Gazette Notice of July 12, 2005 ("OG 
Notice"). Pursuant to the OG Notice, this Request is being filed concurrently with a Notice 
of Appeal. The Applicants respectfully request reconsideration of the rejections of the 
identified Claims in light of the remarks set forth below. 
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REMARKS 

Applicants seek review of the rejections of Claims 2, 5, 13, and 19-27. Applicants do 
not seek review in this Request of the rejection of Claims 1, 3, 4, 6-12, 14-18, and 28-37, and 
39. In a Final Office Action mailed September 8, 2006, Claims 2, 5, and 13 were rejected 
under 35 U.S.C. § 103(a) as being unpatentable over U.S. Patent No. 6,279,113 issued to 
Vimal Vaidya ("Vaidya") in view of U.S. Patent No. Re 36,417 issued to Alan S. Perelson et 
al. ("Perelson"), Applicants request a finding that these rejections are improper and 
allowance of these claims. 

With respect to Claim 2, the Final Office Action contends that the combination of 
Vaidya and Perelson discloses "generating, for each of the modified signature definitions, a 
revised inspector instance based on the modified signature definition and the corresponding 
generated inspector instance." Applicants contend that the combination of Vaidya and 
Perelson does not disclose this limitation for the reasons described in Applicants' Response 
dated November 8, 2006 at pages 10-11. In short, Applicants contend that Perelson fails to 
teach this limitation because the Final Office Action merely points to the equations at column 
6, lines 6-24 of Perelson as disclosing this limitation. See Final Office Action, page 1 1 . 
However, Perelson clearly discloses that these formulas merely determine the "probability 
of a match" between the test string and the original string. See Perelson, column 5, lines 37- 
38 (emphasis added). As a result, the formulas merely allow for a "prediction of] the 
number of initial strings (N R0 ) that will be required to detect an intrusion as a function of the 
probability of detection (1-Pf), the number of segments of original strings being protected 
(Ns), and the matching rule (Pm)." See Perelson, column 6, lines 36-40. Consequently, 
Perelson fails to disclose, expressly or inherently, " generating , for each of the modified 
signature definitions, a revised inspector instance based on the modified signature definition 
and the corresponding generated inspector instance." Thus, the combination of Vaidya and 
Perelson fails to disclose, expressly or inherently, the limitations of Claim 2. 

The above argument was previously presented in Applicants' Response dated 
November 8, 2006 at pages 10-11, and the Advisory Action mailed December 4, 2006 did not 
challenge the correctness of such arguments, but rather rejected Claim 2 without even 
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attempting justification. 1 Accordingly, Applicants contend that the rejection of Claim 2 is 
improper, as is the rejection of Claim 5 that depends therefrom. 

With respect to Claim 13, the Final Office Action once again points to the equations 
at column 6, lines 6-24 of Perelson as disclosing "automatically generating, for each custom 
signature, executable code operable to detect intrusions associated with the custom signature 
based on the generated executable code of an associated default signature." See Final Office 
Action, page 12. However, as discussed above with respect to Claim 2, and described in 
Applicants' Response dated November 8, 2006 at pages 10-12, and also clearly stated by 
Perelson at column 5, lines 37-38, these formulas merely determine the "probability of a 
match" between the test string and the original string. Consequently, Perelson fails to 
disclose, expressly or inherently, "automatically generating , for each custom signature, 
executable code operable to detect intrusions associated with the custom signature based on 
the generated executable code of an associated default signature." Thus, the combination of 
Vaidya and Perelson fails to disclose, expressly or inherently, the limitations of Claim 13. 

The above argument was previously presented in Applicants' Response dated 
November 8, 2006 at pages 10-12, and the Advisory Action did not challenge the correctness 
of such arguments, but rather rejected Claim 13 without even attempting justification. 
Accordingly, Applicants contend that the rejection of Claim 13 is improper. 

In the Final Office Action, Claims 19-27 were rejected under 35 U.S.C. § 103(a) as 
being unpatentable over U.S. Patent No. 5,960,170 issued to Eva Chen et al. ("Chen") in 
view of U.S. Patent No. 6,725,377 issued to Kouznetsov ("Kouznetsov"). Applicants request 
a finding that these rejections are improper and allowance of these claims. 

With respect to Claim 19, the Final Office Action contends that the combination of 
Chen and Kouznetsov discloses "receiving from the sensor data indicative of parameters and 
associated values for the signature to be modified." Applicants contend that the combination 
of Chen and Kouznetsov does not disclose this limitation for the reasons described in 
Applicants' Response dated November 8, 2006 at pages 12-13. In short, Applicants contend 
that the reliance of the Final Office Action, at page 18, on the passage at column 7, lines 39- 
67 of Kouznetsov as disclosing this limitation is incorrect. For example, this passage merely 

1 That the Examiner chose not to enter certain amendments to Claim 2 does not change the fact that the Claim is 
allowable in its independent form. 

2 That the Examiner chose not to enter certain amendments to Claim 13 does not change the fact that the Claim 
is allowable in its independent form. 
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discloses the sending and receiving of identification information . Identification information 
for a server is not, however, data indicative of parameters and associative values for the 
signature to be modified . 

The Advisory Action contends that "two items of data ha[ve] been used (see column 
7, lines 53-58), therefore one [of] ordinary skill in the art could simply interprets [sic] theses 
[sic] two items of data as data indicative of parameters and associated values for [the] 
signature to be modified. However, contrary to this argument, Kouznetsov expressly 
identifies each of these two items as an IP address and a user ID (identification information). 
See Kouznetsov, column 7, lines 57-60. As a result, one of ordinary skill in the art could not 
simply interpret these two items of data as data indicative of parameters and associated values 
for the signature to be modified. Consequently, the combination of Chen and Kouznetsov 
fails to disclose the limitations of Claim 19. Accordingly, Applicants contend that the 
rejection of Claim 19 is improper, as are the rejections of Claims 20-27 that depend 
therefrom. 
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CONCLUSION 



As the rejections of Claims 2, 5, 13 5 and 19-27 contain clear deficiencies, Applicants 
respectfully request a finding of allowance of Claims 2, 5, 13, and 19-27. To the extent 
necessary, the Commissioner is hereby authorized to charge any fees or credit any 
overpayments to Deposit Account No. 02-0384 of BAKER BOTTS l.l.p. 



Date: January 8, 2006 



Correspondence Address: 

Baker Botts L.L.P. 
2001 Ross Avenue, Suite 600 
Dallas, Texas 75201-2980 
(214) 953-6447 

Customer Number: 05073 
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